~betterdevlink | Issues #272 Dec 09, 2024 (24)

Stop worrying about your to-do list. Zapier connects the apps you use every day, so you can focus on what matters most. Start working more efficiently - Create your free account today.

Compromising OpenWrt Supply Chain via Truncated SHA-256 Collision and Command Injection BetterDev usually doesn’t include these kind of vulnerability report. However, this one is very interesting because it happen through using a cache key as a truncate hash of user input data, lead to collision. And caching is common particularlly in web dev, picking right cache key is important to avoid cache poisoning.

Applied offensive security with Rust it’s a from-theory-to-practice guide and you may enjoy it if you are a developer and want to learn security

Breaking the 4Chan CAPTCHA This project was entered into as a learning experience, to enhance my knowledge of machine learning, as well as TensorFlow specifically. At the end, I wanted to have a trained machine learning model that runs in the browser to reliably (at least 80% accuracy, >90% preferred) solve the 4Chan CAPTCHA. These goals were achieved - let’s talk about how I...

Demystifying git submodules Throughout my career, I have found git submodules to be a pain. Because I did not understand them, I kept getting myself into frustrating situations. So, I finally sat down and learned how git tracks submodules. Turns out, it’s not complex at all. It’s just different from how git tracks regular files. It’s just one more thing you have to learn.

Diving into eBPF: Building a Process Tracer from Scratch Today i want to share a story about how i ended up writing a simple process tracer for linux. Using eBPF in go to fix a github actions which i actually didn’t need. We will go over each piece and hopefully you will learn something form it.

Writing down (and searching through) every UUID Most of time you see UUID re-present as text based, but it’s actually a 128 bit integer. The OP makes everyuuid.com to display both the number and text based of every single UUID. They share the challenge of rendering, ordering an searching.

What you need to know about SQLite A compilation of lessons about what the SQLite database engine can and cannot do. It’s written for Rails, but you can apply all the lessons to use SQLite generally.

Deletes are difficult We tend to optimize db for insert and select, and overlook delete. At first glance, the DELETE command seems straightforward. But more ofthen than not on production the delete break down. We’ll uncover why DELETE operations demand careful consideration and explore how to handle them effectively

The Case for Shared Storage If you operate Kafka, you know how important the storage layer is. In K8S, when a pod went down, and come back up, we need o make sure the storage is mounted to the same node, lead to slowness of pod because it needs to detach and re-attach volume. WarpStream is essentially serverless Kafka. They aim to solve this...

Using Transformers.js for AI in the Browser A practical journey to use transformersjs.js to perform ML task directly in browser.

go-taglib This project is a Go library for reading and writing audio metadata tags. It provides a portable solution with no external dependencies required, thanks to an embedded WASM binary. The most interesting part is WASM. So there is no CGO invoke at all even though taglib is a C++ codebase. A very interesting approach

music-metadata Stream and file based music metadata parser for node. Supporting a wide range of audio and tag formats.

quill Simple mac binary signing and notarization from any platform (replacing the codesign utility for simple use cases).

fastmcp Model Context Protocol (MCP) servers are a new, standardized way to provide context and tools to your LLMs, and FastMCP makes building MCP servers simple and intuitive. Create tools, expose resources, and define prompts with clean, Pythonic code:

tonic A rust implementation of gRPC, a high performance, open source, general RPC framework that puts mobile and HTTP/2 first.

bunbuster Ridiculously fast web & TCP fuzzer designed for brute-forcing directories, subdomains, and files on web servers.